Here is the updated, unified Privacy Policy & Terms of Service incorporating the Archie Mobile Application Disclosures into both the Data Collection and Third-Party sections, as well as updating the document header and contact details.
Privacy Policy & Terms of Service for VistaOneTravels.com & Archie App
Effective Date: August 18, 2026 | Last Updated: August 18, 2026
At VistaOneTravels.com (“VistaOne Travels,” “we,” “us,” or “our”), we respect your privacy and are committed to protecting the Personally Identifiable Information (PII) you share with us. This document outlines how we collect, use, store, share, and safeguard your data across our website, cruise booking services, communications, and mobile applications (including the Archie travel application), as well as the terms governing your use of our travel advisor services.
Part 1: Privacy Policy & Data Protection
1. Data Controller Information
For the purposes of the EU General Data Protection Regulation (GDPR) and global data protection laws, VistaOne Travels acts as the Data Controller for personal information collected directly through our website, mobile applications, contact forms, and travel planning consultations.
Website: VistaOneTravels.com
Data Protection Contact: Privacy & Data Operations Desk
Contact Email: privacy@vistaonetravels.com
2. What Personal Data (PII) We Collect
Because planning and executing cruise travel and providing interactive travel recommendations require coordinating with suppliers and technology platforms, we collect several categories of personal data:
A. Data Provided Directly by You
Contact & Identity Information: Full legal names (matching government ID/passport), birthdates, gender, email addresses, physical mailing addresses, and telephone numbers.
Travel & Identity Documentation: Passport numbers, citizenship, passport expiration dates, emergency contact details, and frequent flyer/loyalty program numbers.
Financial & Payment Details: Credit/debit card numbers, billing addresses, and expiration dates. (Note: Payment data is processed securely through PCI-DSS compliant booking gateways and is never stored on unencrypted local servers).
Special Category / Health Data: Dietary requirements, mobility needs, medical accommodation requests, or pregnancy status required for cruise line manifest compliance.
B. Data Collected via the Archie Mobile Application
Location Data: With your explicit consent, we access precise or approximate device location data (via GPS or network triangulation) to provide real-time dining, activity, and travel recommendations near you.
App Usage & Diagnostics: We collect crash logs, performance metrics, and interaction data to improve app functionality and user experience.
Saved Preferences & Itineraries: Places, dining spots, or trip itineraries you bookmark or customize within the app.
C. Data Collected Automatically (Technical & Usage Data)
Device & Connection Data: IP addresses, browser types, operating systems, referring URLs, and language preferences.
Usage Patterns: Pages viewed, links clicked, time spent on specific guides, and interaction with our web forms.
Cookies & Tracking: Data collected through cookies, web beacons, and analytics tools (e.g., Google Analytics). You can manage or disable cookies at any time through your web browser settings.
3. Lawful Basis for Processing Data (GDPR Compliance)
Under the GDPR, every instance of personal data processing must rest on an explicit legal foundation. We process your data under the following legal bases:
Fulfilling Cruise Reservations: Names, Birthdates, Passports, Payment Details — Contractual Necessity (Required to book travel)
Mobile App Location & Features: Precise Location, App Preferences — Consent (Opt-in required via device settings)
Sending Booking Confirmations & Updates: Email, Phone Number, Reservation Codes — Contractual Necessity / Legitimate Interest
Processing Payment Transactions: Credit Card Info, Billing Address — Contractual Necessity
Responding to Inquiries & Quote Requests: Contact Form Entries, Travel Preferences — Consent / Pre-Contractual Steps
Email Newsletters & Promotions: Name, Email Address — Consent (Opt-in required; easily revoked)
Website & App Performance Analytics: IP Address, Cookies, Device Logs — Legitimate Interest / Consent
4. How We Share Your Data (Third-Party Suppliers & Technology Partners)
To complete your travel bookings and power our digital tools, VistaOne Travels shares relevant data with third-party service providers. We do not sell, rent, or trade your personal data to third parties for marketing purposes.
We share data strictly with:
Cruise Lines & Tour Operators: (e.g., Royal Caribbean, Disney Cruise Line, Celebrity, Viking River Cruises) to generate official bookings, stateroom manifests, and passenger records.
Host Agencies & Global Distribution Systems (GDS): Travel management platforms used to process reservation nodes and access group contract rates.
Location & API Services (Archie App): Third-party mapping and venue platforms (such as the Google Places API) to locate nearby venues and calculate routing. Location queries are processed securely and are never sold or leveraged for advertising.
Travel Insurance Providers: To issue requested travel protection quotes and policies.
Payment Gateways & Financial Institutions: PCI-compliant processors that execute secure credit card transactions.
Legal & Regulatory Authorities: When required by law, court order, customs/border protection agencies, or maritime security mandates.
5. Managing Mobile App Permissions
You can manage or revoke location tracking and notification permissions for the Archie app at any time through your device’s native settings:
iOS: Settings > Privacy & Security > Location Services > Archie
Android: Settings > Location > App Permissions > Archie
Disabling location permissions will limit the application’s ability to provide real-time, location-aware dining and activity recommendations.
6. International Data Transfers & GDPR Safeguards
Because cruise vacations involve global itineraries, your personal data may be transferred to and processed by cruise suppliers, port agents, and local tour operators located outside the European Economic Area (EEA) or your home country.
When transferring data internationally, VistaOne Travels ensures appropriate legal safeguards are applied, such as:
Standard Contractual Clauses (SCCs) approved by the European Commission.
Direct necessity to execute your travel contract (Article 49(1)(b) of the GDPR).
7. Data Security Measures
We maintain robust administrative, technical, and physical security measures to safeguard your personal information against unauthorized access, loss, alteration, or disclosure:
Encryption: All website traffic, mobile app API calls, and data transmission forms use standard HTTPS / TLS 1.3 encryption.
Access Controls: Strict role-based access policies ensure that only authorized personnel handle sensitive client information (such as passport details).
PCI-DSS Compliance: Payment card numbers are submitted directly to tokenized merchant gateways; we do not store raw credit card CVV codes.
Data Breach Protocol: In the event of a security incident that compromises your personal data, VistaOne Travels will notify affected individuals and relevant supervisory authorities within 72 hours of verification, as mandated by GDPR.
8. Data Retention Policy
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting obligations:
Active Booking Records: Retained for the duration of your trip + 7 years (for legal, tax, and insurance auditing requirements).
Archie App Account & Preferences: Retained as long as your account remains active or until you request account deletion.
Marketing Subscriptions: Retained until you withdraw consent or click “Unsubscribe.”
Technical Analytics Data: Anonymized or deleted automatically after 26 months.
9. Your Privacy Rights (GDPR, CCPA & US State Laws)
Depending on your geographic location, you hold specific legal rights regarding your personal data:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request that we correct inaccurate or incomplete PII.
Right to Erasure (“Right to be Forgotten”): Request that we delete your personal data (subject to legal retention mandates).
Right to Restrict or Object: Object to data processing based on legitimate interests or direct marketing.
Right to Data Portability: Request a machine-readable transfer of your personal data.
Right to Withdraw Consent: Revoke marketing consent at any time using the “Unsubscribe” link in our emails or by updating your mobile app settings.
California Privacy Rights (CCPA / CPRA Disclosure)
Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, California residents have specific rights regarding their personal information:
Notice of Collection: We collect identity, contact, financial, travel documentation, and precise location data as specified in Section 2 above.
No Sale or Sharing of Personal Data: VistaOne Travels does not sell your personal information or share it with third parties for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: We only use sensitive PII (such as passport details or precise GPS location) to fulfill travel reservations or deliver requested mobile app features.
Non-Discrimination: We will not discriminate against you (e.g., by denying services or charging different rates) for exercising any of your privacy rights.
To exercise any of these rights, submit a written request to privacy@vistaonetravels.com. We respond to all verified requests within 30 days free of charge.
Part 2: Terms of Service & Advisor Disclaimers
By accessing VistaOneTravels.com, using the Archie mobile app, or engaging our services, you agree to the following operational terms:
1. Role as an Independent Travel Advisor
VistaOne Travels acts solely as an intermediary agent between you (the client) and third-party travel suppliers (including cruise lines, airlines, hotels, and excursion operators).
We do not own, operate, or control the cruise ships, hotels, or transport vehicles.
All bookings are subject to the specific terms, conditions, contract of carriage, and cancellation policies imposed by the respective travel supplier.
2. Client Responsibilities (Passports, Visas, & Health)
Identification: Passengers are strictly responsible for obtaining and carrying valid government identification. For international cruises, passports must generally be valid for at least 6 months beyond your scheduled return date.
Visas & Entry Protocols: Travelers are responsible for securing any required entry visas, travel authorizations (e.g., ESTA, ETIAS), or health declarations for ports of call.
Boarding Refusal: VistaOne Travels is not liable if a cruise line or border authority denies you boarding due to improper documentation.
3. Travel Protection & Insurance Warning
Highly Recommended: Cruise fares, shore excursions, and air travel carry strict non-refundable cancellation penalties. VistaOne Travels strongly advises every client to purchase a comprehensive Travel Protection Policy covering trip cancellation, interruption, medical evacuation, and flight delays.
Part 3: Policy Updates & Contact Information
We may update this Privacy Policy & Terms of Service periodically to reflect changes in privacy laws, maritime regulations, mobile app updates, or agency operations. Revisions will be posted on this page and within the Archie app settings with an updated “Last Updated” date.
How to Contact Us
If you have questions, concerns, or legal requests regarding this Privacy Policy or your personal data, please reach out to us at:
Agency Name: Vista One Travels
Mailing Address: [Insert Full Business Street / PO Box Address, City, State, Zip Code]
Data Protection Contact: Privacy & Data Operations Desk
Privacy Email: privacy@vistaonetravels.com
General Inquiries: info@vistaonetravels.com
Archie Mobile App — Privacy Policy
Last updated September 2026
Overview
Archie is a personal travel-companion app. This policy describes what information Archie collects, how it’s used, and who it’s shared with.
Information we collect
Account information you provide: name, email, a password (see “Security” below), and optionally phone, address, birthday, and a profile photo.
Trip information: destination, dates, confirmation numbers, and similar details from a booking confirmation you paste or forward, or — only if you turn on “Add trips by email” — from an email you forward to a shared inbound address.
Search queries you type into Recommendations/Explore, tied to your account.
Ask assistant conversation history, tied to your account.
Your device’s live location, only at the moment you use Near Me or ask the assistant a location-aware question.
How we use it
Your stated interests, food preferences, and allergies re-rank recommendations toward what you’ll likely enjoy — nothing is ever hidden because of them, just reordered, and allergy-flagged dining is excluded outright. Trip details drive weather, packing lists, and day-by-day itinerary content. Questions you ask the assistant are answered using your trip’s real data. Search queries are logged purely to learn what travelers wish Archie covered better — never to change what your own search shows you.
Who we share it with
Each of the following receives only what it needs to answer one specific request — a city name or coordinates, not your name, email, or account details — except where noted:
- Anthropic (Claude) — for the Ask assistant’s answers and for generating a destination’s curated recommendations. Your question and relevant trip context are sent to produce that one answer.
- Open-Meteo — weather forecasts, by city name/coordinates only.
- OpenStreetMap (via the Overpass API) and Geoapify — dining, shopping, and landmark lookups, by coordinates only.
- Wikipedia — city facts and landmark photos, by place name only.
- Unsplash — destination photos, by city name only.
- Google (Gmail API) — only if you turn on “Add trips by email”: a forwarded booking email is received at a shared inbound address Archie controls (not your personal inbox), matched to your account by its sender address. Gmail is also used to send you a password-reset code when you request one.
We do not sell your data, and we do not share it for advertising or marketing. Archie doesn’t use any third-party analytics or ad-tracking SDKs.
International data transfers
Archie is operated from the United States, and some of the third parties listed above (Anthropic, Google) are also based in the United States. If you’re located outside the US, the information described in this policy may be transferred to, stored, and processed in the United States, where data protection laws may differ from those where you live. Where required, we rely on appropriate safeguards for these transfers, such as standard contractual clauses with our service providers.
Location
Your device’s location is used live, for the single request that asked for it (a Near Me lookup, or a location-aware question to the assistant) — it is not stored after that request completes.
Photos
If you choose to add a profile picture or a photo of a port of call, the app can access your camera or photo library. Photos you add are stored with your account; we never access your camera roll except when you actively choose to pick or take a photo.
Biometric lock
If you enable Face ID/fingerprint lock, the actual biometric data is handled entirely by your device’s own operating system — Archie never sees or stores it. Archie only stores the on/off preference itself, on your device.
Data retention and deletion
Deleting your account (available any time from Profile > Personal Information, right in the app) removes your profile, trips, Ask conversation history, search history, and any pending password-reset codes. This happens immediately and is not reversible.
Your rights under GDPR (EEA and UK residents)
If you’re located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) — and the UK’s own equivalent, UK GDPR — gives you rights over your personal information beyond account deletion, and Archie acts as the data controller for the account information described above.
Our legal basis for processing depends on what we’re doing with it: creating and running your account, parsing your trip details, and generating recommendations and Ask assistant answers are all necessary to perform our contract with you. Anything optional — “Add trips by email,” biometric lock, adding a profile photo — is based on your consent, which you can withdraw at any time by turning that feature off. Logging search queries (see “How we use it” above) is based on our legitimate interest in improving what Archie covers, which never overrides your own privacy rights.
You have the right to: access the personal information we hold about you; correct it if it’s inaccurate; request it be deleted; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent for anything based on consent, at any time. To exercise any of these rights, contact us at the email below — we handle these requests by hand and will respond within 30 days. If you’re not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
Security
Your password is hashed (bcrypt) before storage — Archie never stores it in plain text and cannot look it up, only verify a match. Data in transit between the app and our servers is encrypted.
Children’s privacy
Archie is not directed at children under 13, and we do not knowingly collect information from them.
Changes to this policy
If what Archie collects or how it’s used changes meaningfully, this page will be updated and the “last updated” date above will change.
Contact
Questions about this policy or your data: privacy@vistaonetravels.com